The main goal of anti-virus software is to remove virus and other malware from computing devices. Once a virus is identified by the anti-virus software, it is either removed or quarantined. This approach works reasonably well when a virus can be identified as a piece of stand alone file. Sometimes virus can become part of a file by infecting it. For example, a Microsoft Word document may get infected by a macro virus. Cleaning macro virus from the document is a relatively simple task, but there are viruses that can infect a valid binary residing on the device. In those cases the removal or quarantine of the binary may have adverse effects on the system. In extreme cases, the system may become unusable.
Detecting and fixing an infected binary or file is not as straight forward as fixing an infected word document because the location and scope of the virus in the infected file cannot be easily determined. In addition, virus may even scramble the original byte code after infecting the file and thereby making the detection and eradication of malware essentially impossible.
Every anti-virus program available in the market today either removes or quarantines infected or malicious files as a mechanism for virus and malware remediation. These approaches do not work for file infector virus. In case of file infectors that target existing binary files, removal or quarantine of a file results into loss of functionality. In such a case users are forced to re-install or restore the operating system.
A few approaches have been suggested to fix. One such approach requires booting the computer in secondary operating system and applying fixes, but the mechanism for fix is left to the anti-virus software and clearly that does not solve the problem of complex file infectors [1]. Unfortunately these approaches are limited and somewhat impractical as the virus can contaminate the local copy. Some operating systems [2] create a snapshot and can revert back and similar approach has been proposed [3] to replace infected file with a backup copy. If the re-install or restore is done based on image files stored on the computer, there is a chance that they too may be infected and therefore it is not a good and reliable method. The re-install or restore can be done based on images files stored outside is a more robust method, but it is not very convenient.
A simple and scalable approach to cleaning infected files is needed that can remove any malware that infects an application file. One method that shows promise in fixing file infectors is to use a Web or network service to selectively update or replace the files that are deemed infected. This approach combines the ease of use, efficiency, scalability, and reliability in fixing the file infector virus.
Therefore, a need exists for systems and methods to improve detection of virus, including polymorphic and metamorphic virus, which is scalable and does not rely on the end user to make the final decision. Such a solution will not only save corporations several billion dollars each year, but it will be critical in maintaining the integrity of government and financial network infrastructure and consumer computers.